v0.23.1

---

version: 0.23.1
date: 2026-06-10
headline: "Patch — fix the ci-ok workflow parse error that kept v0.23.0's CI red and its publish refused."
themes: ["ci"]
highlights:

• "ci.yml parses again — the ci-ok green echo is now a block scalar"
• "v0.23.0's publish was refused by the ci-green witness gate, exactly as designed"
• "This tag carries the full v0.23.0 content to PyPI"

---

TL;DR — v0.23.0's tag push was refused by the publish pipeline's ci-green witness gate: the ci-ok aggregator job (added just before the release) had a YAML parse error, so no CI run on that SHA could ever green. This patch fixes the parse and re-cuts; everything in the v0.23.0 notes ships under this version.

ci — the fix

• The ci-ok "all green" step used a plain scalar containing : — YAML read the colon-space inside the echo text as a nested mapping and the whole workflow failed at parse time (0-second runs, no legs created).
  • How: .github/workflows/ci.yml — the step body is now a run: | block scalar, matching its sibling refuse step.
• The witness gate worked. publish.yml built and checked the artifacts, then refused the upload because no green ci.yml run existed on the tagged bytes — the forgeable "I tagged it" claim stopped by the unforgeable CI witness. The v0.23.0 tag stays where it is; fix-forward is the rule.